Analysis
-
max time kernel
91s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
16-12-2022 23:09
General
-
Target
ddede9992ebc5f4f1f97c245941b77eef0b426b5cfb17d0cc01412d4013b1dcd.exe
-
Size
286KB
-
MD5
110dc48032e5ac0abbd4a47a3b49b5d9
-
SHA1
86cd62ba0db1168a80869d1eaa63aef9deba45f9
-
SHA256
ddede9992ebc5f4f1f97c245941b77eef0b426b5cfb17d0cc01412d4013b1dcd
-
SHA512
22c7e339d7eeedd3751cd7e647aad8d52e411670e4977a4dc3cca8fc845e605c0c85b75893d95061de79e49536d1fd9c2b31e4e0c79ca4883b98f0a082f1f57e
-
SSDEEP
6144:2i42XLRQ9n6kQVfZqz/cExicFBiDoLgzZjb40M2b:jzqUVx0cE8EYF
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddede9992ebc5f4f1f97c245941b77eef0b426b5cfb17d0cc01412d4013b1dcd.exe"C:\Users\Admin\AppData\Local\Temp\ddede9992ebc5f4f1f97c245941b77eef0b426b5cfb17d0cc01412d4013b1dcd.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 6562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2284 -ip 22841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
400KB
-
Filesize
116KB
-
Filesize
136KB
-
Filesize
400KB
-
Filesize
116KB